Accessing Medical Records in Tasmania: PIPA, RTI and APP 12

Tasmania has no private-sector health-records Act, so a public hospital record is requested under the Personal Information Protection Act 2004 and, if needed, the Right to Information Act 2009, while a private GP or specialist record is requested under the federal Privacy Act 1988's Australian Privacy Principle 12.

Tasmania splits medical-records access along the same public/private line used across Australia, but its public-sector process has an unusual two-step structure worth understanding before you write a request letter. This guide covers who can request records, how the public and private pathways differ, response timeframes, fees, refusal grounds and where to complain, sourced to the Personal Information Protection Act 2004, the Right to Information Act 2009 and the federal Privacy Act 1988.

Which Law Covers Which Provider

A record held by a Tasmanian public hospital or public health service is personal information held by a public authority, and so falls under the Personal Information Protection Act 2004 (PIPA) and, where PIPA's own process is exhausted, the Right to Information Act 2009 (RTI Act).

A record held by an independent private GP clinic, specialist practice or private hospital is a different matter. PIPA's definitions section limits who counts as a "personal information custodian" to public authorities, bodies or people operating under a "personal information contract" with a public authority (in practice, a government services contractor), and prescribed bodies. A private clinic with no government contract does not fit any of those categories, so it sits entirely outside PIPA. This is confirmed directly against the Act's own definitions text, not assumed from a general pattern, and it is corroborated by the Office of the Australian Information Commissioner's own comparative summary, which lists Tasmania among the states whose privacy legislation applies only to the public sector. Private Tasmanian providers are instead governed solely by the federal Privacy Act 1988 and Australian Privacy Principle 12 (APP 12), the same as private providers in Queensland, Western Australia, South Australia and the Northern Territory. See recordinglaw.com's guide to the Australian Privacy Principles for how APP 12 works in full.

Who Can Request

Any individual can request their own personal information under PIPA, and any person can lodge an RTI Act application (the RTI Act is not limited to the record subject, though a request for someone else's personal information is assessed differently). recordinglaw.com could not independently confirm this session what provision, if any, governs access on behalf of a deceased patient in Tasmania, or what minor or guardian-consent rules apply to a request for a child's records; PIPA's own definition of "personal information" does exclude a person who has been dead for more than 25 years, which sets an outer limit on how long PIPA protection runs, but the identity of who may apply within that window on a deceased person's behalf was not confirmed against a primary Tasmanian government source this session. Anyone in that situation should confirm directly with the record holder or the Tasmanian Ombudsman before relying on an assumed right.

For decisions about a patient's healthcare and who can make them when the patient cannot, see recordinglaw.com's guide to enduring guardianship and health decisions in Australia and, for appointing someone to manage broader personal and financial affairs, the guide to enduring power of attorney in Tasmania.

How to Request

Public hospital route. The Tasmanian Department of Health maintains a dedicated process for its own hospital records, with a prepared application form and a mailing address at Health Information Management Services, Royal Hobart Hospital, GPO Box 1061, Hobart TAS 7000, alongside an email option. A first request of this kind is made under PIPA's access principle.

The PIPA-to-RTI escalation, a structural quirk worth knowing. PIPA's Schedule 1 access principle says a personal information custodian "may" provide access on a written request, worded as discretionary rather than as a guaranteed right. If the custodian refuses, or simply does not respond within 20 working days, a further written request is then treated as if it were an RTI Act application for assessed disclosure, and the custodian becomes subject to the RTI Act's rules from that point. In practice this means the enforceable, deadline-bound right only attaches on the second request, after a refusal or a 20-working-day silence, not on the very first letter. This differs from Victoria's approach, where the equivalent principle imposes a direct 45-day statutory response obligation from the first request.

Private provider route. A request to a private GP, specialist or private hospital is made directly to the practice under APP 12 of the Privacy Act 1988. There is no Tasmanian form or process for this category, because no Tasmanian Act applies to it.

Timeframes

PIPA's first-instance request carries no hard statutory deadline; the 20-working-day figure functions only as the trigger point for escalating to an RTI Act application. Once an application is being handled under the RTI Act, section 15(1) requires a public authority to take all reasonable steps to notify the applicant of a decision as soon as practicable, and in any case not later than 20 working days after the application is accepted, extendable by a further 20 working days where third parties need to be consulted.

For a private provider, APP 12 does not set a fixed number of days at all. The Privacy Act's text requires only that an organisation respond "within a reasonable period" after the request is made; a commonly cited 30-day figure for private providers comes from Office of the Australian Information Commissioner guidance describing good practice, not from the statute itself, and should not be treated as a legal deadline.

Fees

The RTI Act sets an application fee of 25 fee units for an assessed disclosure application, waivable for applicants facing financial hardship, MPs acting in that capacity, journalists, or on public-interest grounds. At the current 2026-27 fee-unit value of $1.96, gazetted 18 March 2026 by Treasury Tasmania, that works out to $49.00. Treasury Tasmania updates the fee-unit value each financial year, so confirm the current figure directly with Treasury Tasmania or the agency handling your application if you are applying outside the 2026-27 financial year. A first-instance PIPA request carries no fee provision in the principle itself; the Tasmanian Department of Health's own guidance states only that it will advise of any charges and that information may be withheld until charges are paid, without stating a figure.

A private provider may charge under APP 12.8: the charge must not be excessive, and there must be no charge at all for making the request itself, only for the reasonable cost of providing access.

Grounds for Refusal

The RTI Act contains standard exemption categories covering information already reasonably available elsewhere, requests that would unreasonably divert an agency's resources, and vexatious or repeat applications, along with the usual RTI exemption classes such as third-party personal information, law enforcement material and Cabinet documents. recordinglaw.com located the general shape of these grounds via secondary sources this session but did not independently confirm the specific section numbers against the Act's own text, so treat the exact provisions as a starting point rather than a citable reference. A private provider may refuse under APP 12.3 on grounds including a reasonably believed serious threat to someone's life, health or safety, an unreasonable impact on another person's privacy, a frivolous or vexatious request, a connection to legal proceedings, or where access is otherwise unlawful.

Complaints and Review

A PIPA complaint goes to the Tasmanian Ombudsman, but only after the person has first raised the matter with the record custodian and remains unsatisfied with the response. A general PIPA complaint must be made within 6 months of becoming aware of the issue, or within a further period the Ombudsman allows; a complaint specifically about a refusal to correct information has a tighter 20-working-day window from the decision notice. The Ombudsman investigates under the Ombudsman Act 1978 and, on finding a contravention, advises both parties in writing with reasons and may make recommendations; the text available this session reads as a recommendation power rather than a binding-order power, though this was not checked against every other part of the Act.

An RTI Act decision goes through internal review by the agency first, then external review by the Ombudsman. Secondary sources describe the Ombudsman as the sole and final external review step for Tasmanian RTI decisions, with no separate tribunal appeal comparable to Victoria's VCAT, but recordinglaw.com could not independently confirm this against the Ombudsman's own published material this session.

A complaint about a private provider's handling of an access request goes to the Office of the Australian Information Commissioner (OAIC), the federal privacy regulator, since private Tasmanian providers sit under the federal Privacy Act rather than PIPA. See recordinglaw.com's guide to how to make a privacy complaint in Australia for the OAIC complaint process, and the guide to notifiable data breaches if the concern involves a suspected breach rather than a plain access refusal.

Related Reading

For how another smaller jurisdiction handles the same public/private split, see recordinglaw.com's guide to medical records access in the Northern Territory. For the national picture, including My Health Record and the Commonwealth Freedom of Information Act, see the Australia medical records hub.